PENDING LEGAL REVIEW — this text has not been approved by a lawyer. Highlighted parts are not decided yet.
Contact and Requests
If you are in an emergency this page cannot help you: call your local emergency number now (your local emergency number). These mailboxes are not monitored for emergencies.
1. Who to write to
- Your personal data, KVKK / GDPR requests, account deletion: privacy@koruya.app
- Support for the app, the web app and the site: support@koruya.app
- Legal notices and infringement: legal@koruya.app
- Security vulnerability reports: account@koruya.app (Reporting a Security Vulnerability page)
- Postal address for requests: postal address for requests will be published soon. KEP (registered e-mail): registered e-mail (KEP) address will be published soon.
- Data controller: operator details (legal name, address, registration number) will be published soon.
2. How to make a data subject request
- Write to privacy@koruya.app from the e-mail address registered to your Koruya account. If you have no account, write from the e-mail address you used.
- Put your request in the subject: e.g. "Information request", "Copy of my data", "Correction", "Deletion", "Objection", "I withdraw my consent".
- Give your name, your request and which product you use (mobile app, web app, site, family group). Do not send an identity number, a photo of an ID or health information; they are not needed.
- In Türkiye you can also make a KVKK request in writing or by KEP (Communiqué on the Procedures for Applications to the Data Controller).
3. What happens next
- We confirm by e-mail that we received your request [acknowledgement period — decision].
- We confirm it is you by checking that you wrote from the e-mail registered to your account; if needed we may ask you to take a step in your account.
- We answer free of charge within 30 days at the latest (KVKK Art. 13). If the request causes an extra cost, the fee set by the Board may apply [legal confirmation].
- If you asked for a copy of your data, we send the data in your cloud account in a commonly used, machine-readable format (JSON) [export tool — to do]. Data kept on your device and in your browser is already with you; Koruya cannot access it.
- If we refuse a request we tell you why.
- If you are not satisfied with our answer you can complain to the Personal Data Protection Board in Türkiye, to your country's data protection authority in the EU, or to the ICO in the United Kingdom.
4. What you can do yourself
- Delete the account: in the app under Profile → Account → Delete account, or at https://koruya.app/en/delete-account/.
- Stop the cloud copy of your health information: withdraw consent on the Emergency Profile screen.
- Turn family location sharing off: on that group's screen.
- Delete the data on this device: Settings → Delete data on this device; in the web app, Settings → delete the data in this browser.
- See your agreement records and withdraw the ones that can be withdrawn: in the app under Settings → Legal and privacy.
5. Keeping correspondence
Request and deletion correspondence is kept for [1 year — decision] after the request is completed, then deleted.